The Package You Just Installed Has 400 Dependencies

You needed a function that adds a question mark to a URL if it doesn't have one.

You npm-installed a package.

Your node_modules just grew by 1.2GB.

The Dependency Snowball

You run npm ls --depth=0 and it's like looking at the cast list for a movie that's 95% cameos:

├── url-utils@2.1.0
│   ├── lodash@4.17.21          (you know, just in case)
│   ├── query-string@7.1.1
│   │   ├── decode-uri-component@0.2.2
│   │   ├── split-on-first@1.0.0
│   │   └── filter-obj@1.1.0
│   ├── @types/node@22.x        (why? it's a runtime package)
│   ├── tslib@2.8.0             (typescript runtime, for a JS package, that does URL strings)
│   └── debug@4.3.7
│       └── ms@2.1.3            (to parse time strings, for debug logging, for a URL helper)

Your dependency tree has more depth than a black hole. There's a package called is-plain-object that's pulled in at least seven times by seven different sub-dependencies, and npm has somehow deduped it into three different versions because one of them was is-plain-object@2 and another was is-plain-object@5 and they're not compatible even though they do the exact same thing.

The Math

• node_modules count: 12,847 packages
• Your actual code: 3 files, 89 lines
• Ratio: for every line you wrote, you're shipping 144 lines of someone else's code
• Your Docker image went from 40MB to 420MB
• The CI build now takes 4 minutes longer because it's installing node-sass which was pulled in by a package that was pulled in by your URL helper

The Fix

// The package:
import { appendQuery } from 'url-query-utils';

// What it does:
const appendQuery = (url) => {
  try {
    const u = new URL(url, 'http://base');
    return u.search ? `${u.pathname}&` : `${u.pathname}?`;
  } catch {
    return url.includes('?') ? `${url}&` : `${url}?`;
  }
};

Six characters. Zero dependencies. No semver nightmares when some transitive dependency gets yanked from npm because the maintainer "left the industry."

Write the function. It's fine. Your codebase will be lighter, your CI will be faster, and your future self won't be tracing a bug through 40 layers of node_modules trying to find which version of array-flatten broke your build.

Before you npm install anything, ask yourself: could I write this in a comment? Probably.